@onereach/si-a-button@0.0.5

Analysis

The preinstall hook (node setup.mjs) downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun and executes a 727KB file (math_init.js) at install time. math_init.js is heavily obfuscated with a custom base85 string-table encoder, so its actual behaviour is not readable from source. The package is a Vue button component whose shipped component code (lib/) does not require Bun or any runtime, so the install-time download-and-execute of an opaque obfuscated payload is unrelated to the package's stated purpose. The obfuscated payload's network and file activity could not be determined from static analysis.